The following factors can be shown to have contributed to a risk of collision between the two aircraft: the mental model of the controllers was based on erroneous information regarding the cleared FL of COA422; the lack of a detailed review by the controllers of the aircraft data presented on the RSit and the flight data strips, to enable them to update their mental model; the FL information received from the aircrew was not confirmed by a readback, nor is there a requirement to do so; the Radar Data Processing System is not able to automatically cross-check, independent of a controller's action, an aircraft's flight planned track and altitude/FL with the actual route of the flight and altitude/FL ; the lack of a ground-based collision avoidance system at Vancouver ACC at that time; and the scheduling of a short changeover from a midnight to an afternoon shift for one of the controllers, which may have set up a condition of fatigue. The realization by the Holberg controller that there was a conflict and the issuing of the turn was sufficient to prevent a mid-air collision; however, it was too late to prevent the loss of separation or prevent the TCAS from generating RAs in both aircraft cockpits. The initial action by the Seattle ARTCC Sector3 radar controller (i.e. inadvertently issuing the clearance to FL370) was not detected during the readback from the pilot of COA422. The most plausible reason for this was that the Seattle radar controller was expecting to hear FL370, and there was no other salient cue present to lead him to conclude that the FL issued and read back was the incorrect one. Based on the data passed from controller to controller and the flight data strip, however, all parts of the air management system - the Seattle ARTCC Sector3 data controller, as well as the Vancouver ACC controllers - was operating under the assumption that COA422 was climbing to FL310, and was providing separation for that flight up to and including that FL. The Seattle ARTCC and Vancouver ACC controllers' mental models did not match the reality of the situation, which lead to the risk of collision between COA422 and AAR284. The error defence provided by the NAV CANADA strip-marking procedures was bypassed when the Vancouver controllers did not annotate the altitude boxes to indicate that the altitude provided by the pilot matched that on the flight data strip. Inadequate information processing and cross-checking led to a lack of situational awareness and an inaccurate mental model among Vancouver ACC controllers. The random scanning task is challenging for most people and is rarely carried out effectively. A conscious, self-enforced practice to carry out a detailed check of all displayed elements of a data block on initial contact with an aircraft is designed to lead to the confirmation of accurate data and the detection of potential conflicts. An automated comparison between the aircraft's actual FL and flight plan data or electronic flight data strip information may have alerted the controller to the developing conflict and prevented this incident. The hand-off and the initial radio contact by an aircraft are critical times when controllers are expected to review and verify important information in detail. Passive acknowledgement of new information - the single word roger, for instance - rather than a deliberate and active review of each element of the information, may not provide the important cues to assist the controller in detecting potential discrepancies. Once a controller's mental model is firmly established, it resists being modified, even if subsequent data conflicts with the mental model. As a result, the ability of controllers to accurately forecast the future position and status of aircraft under their control is reduced. There are a number of situations in which a readback of information is not required by regulations or procedures, and a simple acknowledgement that information was heard is considered sufficient (often with the word roger). Had the FL information been heard and processed by the controllers, they may have been cued to the discrepancy between the FL stated by the pilot and that contained in the controller's mental model of the situation, and taken appropriate action. In this incident, the pilot of COA422 stated that the flight was climbing to, or level at, FL370 in three separate radio transmissions. By reading back the FL to the pilot, the controller may have detected the discrepancy. The pilot of COA422 did not advise the West controller on reaching the cleared FL of FL370. Although not a requirement under U.S. regulations, Canadian published procedures do require pilots to make such a report. This omission eliminated an opportunity for the West controller to realize that the aircraft was at a different FL than what he expected. There was no automated conflict probe, conflict detection, or conformance-monitoring capability functional in Vancouver ACC. This type of technological support would have warned that COA422 had climbed above the flight-planned FL of FL310. Similarly, without the short-term conflict alerting system, it was the combination of a last-minute turn and a TCAS alert that prevented a possible mid-air collision. Conflict alert is in operation in several area control centres in Canada, including Vancouver. The distraction resulting from competing air traffic priorities at the time of initial contact by COA422 with both the West and Holberg controllers may have disrupted their normal practice of comparing the FL written on the strip with the FL stated by the pilot. In both the Holberg/Nootka and the West sectors, each controller was working alone and was responsible for all activities associated with the radar and data positions. This required them to divide their attention among several tasks and elevated the risk that some information may have been missed or its importance minimized. In this incident, all references by COA422 to FL370 were missed, as was the display of FL370 on the data tag. The Holberg controller had worked a previous midnight shift and had six hours sleep before starting his next shift. The controller's sleep-wake pattern likely increased his level of fatigue and elevated the risk of task-performance decrements. His performance during this incident raised the possibility that he was operating with a sleep debt.Analysis The following factors can be shown to have contributed to a risk of collision between the two aircraft: the mental model of the controllers was based on erroneous information regarding the cleared FL of COA422; the lack of a detailed review by the controllers of the aircraft data presented on the RSit and the flight data strips, to enable them to update their mental model; the FL information received from the aircrew was not confirmed by a readback, nor is there a requirement to do so; the Radar Data Processing System is not able to automatically cross-check, independent of a controller's action, an aircraft's flight planned track and altitude/FL with the actual route of the flight and altitude/FL ; the lack of a ground-based collision avoidance system at Vancouver ACC at that time; and the scheduling of a short changeover from a midnight to an afternoon shift for one of the controllers, which may have set up a condition of fatigue. The realization by the Holberg controller that there was a conflict and the issuing of the turn was sufficient to prevent a mid-air collision; however, it was too late to prevent the loss of separation or prevent the TCAS from generating RAs in both aircraft cockpits. The initial action by the Seattle ARTCC Sector3 radar controller (i.e. inadvertently issuing the clearance to FL370) was not detected during the readback from the pilot of COA422. The most plausible reason for this was that the Seattle radar controller was expecting to hear FL370, and there was no other salient cue present to lead him to conclude that the FL issued and read back was the incorrect one. Based on the data passed from controller to controller and the flight data strip, however, all parts of the air management system - the Seattle ARTCC Sector3 data controller, as well as the Vancouver ACC controllers - was operating under the assumption that COA422 was climbing to FL310, and was providing separation for that flight up to and including that FL. The Seattle ARTCC and Vancouver ACC controllers' mental models did not match the reality of the situation, which lead to the risk of collision between COA422 and AAR284. The error defence provided by the NAV CANADA strip-marking procedures was bypassed when the Vancouver controllers did not annotate the altitude boxes to indicate that the altitude provided by the pilot matched that on the flight data strip. Inadequate information processing and cross-checking led to a lack of situational awareness and an inaccurate mental model among Vancouver ACC controllers. The random scanning task is challenging for most people and is rarely carried out effectively. A conscious, self-enforced practice to carry out a detailed check of all displayed elements of a data block on initial contact with an aircraft is designed to lead to the confirmation of accurate data and the detection of potential conflicts. An automated comparison between the aircraft's actual FL and flight plan data or electronic flight data strip information may have alerted the controller to the developing conflict and prevented this incident. The hand-off and the initial radio contact by an aircraft are critical times when controllers are expected to review and verify important information in detail. Passive acknowledgement of new information - the single word roger, for instance - rather than a deliberate and active review of each element of the information, may not provide the important cues to assist the controller in detecting potential discrepancies. Once a controller's mental model is firmly established, it resists being modified, even if subsequent data conflicts with the mental model. As a result, the ability of controllers to accurately forecast the future position and status of aircraft under their control is reduced. There are a number of situations in which a readback of information is not required by regulations or procedures, and a simple acknowledgement that information was heard is considered sufficient (often with the word roger). Had the FL information been heard and processed by the controllers, they may have been cued to the discrepancy between the FL stated by the pilot and that contained in the controller's mental model of the situation, and taken appropriate action. In this incident, the pilot of COA422 stated that the flight was climbing to, or level at, FL370 in three separate radio transmissions. By reading back the FL to the pilot, the controller may have detected the discrepancy. The pilot of COA422 did not advise the West controller on reaching the cleared FL of FL370. Although not a requirement under U.S. regulations, Canadian published procedures do require pilots to make such a report. This omission eliminated an opportunity for the West controller to realize that the aircraft was at a different FL than what he expected. There was no automated conflict probe, conflict detection, or conformance-monitoring capability functional in Vancouver ACC. This type of technological support would have warned that COA422 had climbed above the flight-planned FL of FL310. Similarly, without the short-term conflict alerting system, it was the combination of a last-minute turn and a TCAS alert that prevented a possible mid-air collision. Conflict alert is in operation in several area control centres in Canada, including Vancouver. The distraction resulting from competing air traffic priorities at the time of initial contact by COA422 with both the West and Holberg controllers may have disrupted their normal practice of comparing the FL written on the strip with the FL stated by the pilot. In both the Holberg/Nootka and the West sectors, each controller was working alone and was responsible for all activities associated with the radar and data positions. This required them to divide their attention among several tasks and elevated the risk that some information may have been missed or its importance minimized. In this incident, all references by COA422 to FL370 were missed, as was the display of FL370 on the data tag. The Holberg controller had worked a previous midnight shift and had six hours sleep before starting his next shift. The controller's sleep-wake pattern likely increased his level of fatigue and elevated the risk of task-performance decrements. His performance during this incident raised the possibility that he was operating with a sleep debt. The Seattle ARTCC controller inadvertently cleared COA422 to FL370 rather than FL310, and none of the involved controllers - Seattle, West or Holberg - detected that the aircraft was flying at FL370 and not FL310, despite many clues. The result was that ATC was not providing separation for COA422 between FL310 and FL370, resulting in a loss of separation and risk of collision.Findings as to Causes and Contributing Factors The Seattle ARTCC controller inadvertently cleared COA422 to FL370 rather than FL310, and none of the involved controllers - Seattle, West or Holberg - detected that the aircraft was flying at FL370 and not FL310, despite many clues. The result was that ATC was not providing separation for COA422 between FL310 and FL370, resulting in a loss of separation and risk of collision. A single controller was working a combined data and radar position in the Sandspit, West and Holberg/Nootka sectors, which was a normal practice for the level of traffic experienced at the time of the incident. However, this placed an increased demand on the controller to properly prioritize his actions and ensure that the required level of attention was focussed on the immediate task. In short, it increased the risk that information would be missed. The distraction resulting from competing air traffic priorities, such as changing the transponder code immediately after the initial communication from COA422, may have disrupted the West controller's normal practice of comparing the FL written on the strip with the altitude information provided by the pilot. The Holberg controller was working a shift after the minimum 10hours off, after having completed a midnight shift. The controller may have been working with a sleep debt, with a resulting reduction in his alertness level.Findings as to Risk A single controller was working a combined data and radar position in the Sandspit, West and Holberg/Nootka sectors, which was a normal practice for the level of traffic experienced at the time of the incident. However, this placed an increased demand on the controller to properly prioritize his actions and ensure that the required level of attention was focussed on the immediate task. In short, it increased the risk that information would be missed. The distraction resulting from competing air traffic priorities, such as changing the transponder code immediately after the initial communication from COA422, may have disrupted the West controller's normal practice of comparing the FL written on the strip with the altitude information provided by the pilot. The Holberg controller was working a shift after the minimum 10hours off, after having completed a midnight shift. The controller may have been working with a sleep debt, with a resulting reduction in his alertness level. Canadian published procedures require a pilot to report when he/she is reaching the FL to which the flight has been initially cleared. There is no equivalent requirement in U.S. regulations for pilots to do so. COA422 did not report reaching FL370, and this eliminated an opportunity for the Vancouver West controller to detect that COA422 was at a different FL than what was expected. There was no automated conflict detection or conformance monitoring system operational in Vancouver ACC at that time. Either one of these technological supports may have alerted the controller that COA422 had climbed above the flight-planned FL, or provided a warning of the conflict with AAR284.Other Findings Canadian published procedures require a pilot to report when he/she is reaching the FL to which the flight has been initially cleared. There is no equivalent requirement in U.S. regulations for pilots to do so. COA422 did not report reaching FL370, and this eliminated an opportunity for the Vancouver West controller to detect that COA422 was at a different FL than what was expected. There was no automated conflict detection or conformance monitoring system operational in Vancouver ACC at that time. Either one of these technological supports may have alerted the controller that COA422 had climbed above the flight-planned FL, or provided a warning of the conflict with AAR284. NAV CANADA's conflict alert function is now operational in Vancouver ACC controlled airspace above 14000feet. Additionally, other functions such as an airspace warning feature and special-use airspace incursion detection equipment are being progressively developed, tested, and deployed.Safety Action Taken NAV CANADA's conflict alert function is now operational in Vancouver ACC controlled airspace above 14000feet. Additionally, other functions such as an airspace warning feature and special-use airspace incursion detection equipment are being progressively developed, tested, and deployed.